[SOLVED] Same subnet, two firewalls

I've got a configuration with 2 ADSL lines, with 2 different firewalls, one of them is pfSense (let's call it FW1) while the other is an untouchable appliance (let's call it FW2). On the LAN, many servers (both Linux and Windows) are configured with pfSense as Gateway, while a bunch of them with the appliance as gateway.

On pfSense I've configured an OpenVpn access, so I'm able to connect (via RDP, for instance) to a computer whose gateway is the pfSense itself.

The problem is that, through OpenVpn or directly through a simple NAT rule, I cannot reach a server whose gateway is the appliance (the other firewall). It even doesn't reply to an ICMP request.

Since the LAN configuration cannot be modified, I'm wondering if there's a way to respond to a request through the originating firewall, rather than the configured gateway.

To help You better understand, here's a simple representation of the lan :

Your English is just fine, but I wanted to confirm what I thought you were saying. I don't think this will ever work like this, or at least I do not know how if it is possible. You are starting a session through one stateful firewall and getting replies from another completely different firewall, which your end is dropping. Maybe one of the smarter network guys here has a trick up his sleeve, but I don't.

You could create an outbound NAT rule on FW1, that translates the source address on traffic destined for SRV2 to the LAN IP address of FW1. But this way, the logs on SRV2 will always display the IP address of FW1 as the client, when traffic from clients comes through FW1. Could be a security issue.

Add static routes on SRV2 that tells it when to use FW1 as the gateway. For instance, add a static route on SRV2 that covers the subnet you use for OpenVPN clients.

The traffic will not be routed through FW2, not when it originates from FW1. That's what the outbound NAT rule does. SRV2 will see the FW1 as the client, and since they are in the same subnet, it will not need to route the returning traffic to the default gateway. This won't affect the existing traffic that normally passes through FW2 towards SRV2.

Remember to use your LAN-interface on the oubound NAT rule, and set the destination to SRV2 (or create an alias containing the server(s) and use that). If you know what source addresses that will be accessing SRV2 through FW1, you should also enter source address.